Overview

overview

10

Static

static

r.php.dll

windows7_x64

10

r.php.dll

windows10_x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    r.php
  • Size 440KB
  • Sample201202-ff2b8wv312
  • SHA256 5c5c8af2a703aa1842f4ce9f9e83aeeac0e2cc2d3ed1bf9f9ad72b7f77e89a42
  • MD5 SHA1 SHA512
Score
10/10
zloadernut02/12botnettrojan

Malware Config

Extracted

Family

  • zloader

Botnet

  • nut

Campaign

  • 02/12

C2

  • https://www.alhasanatbooks.com/reader.php

  • https://aflim.org.ng/wp-punch.php

  • https://sardarmohammad.com/reports.php

  • https://erikarabelo.com.br/server.php

  • https://thechapelofthehealingcross.org/java.php

  • https://grebcanualcwilfprofal.ml/wp-smarts.php

rc4.plain
rsa_pubkey.plain

Targets

    • Target
      r.php
    • Size 440KB
    • SHA256 5c5c8af2a703aa1842f4ce9f9e83aeeac0e2cc2d3ed1bf9f9ad72b7f77e89a42
    • MD5 SHA1 SHA512
    Score
    10/10
    zloadernut02/12botnettrojan

    • Zloader, Terdot, DELoader, ZeusSphinx

      Zloader is a malware strain that was initially discovered back in August 2015.

      trojanbotnetzloader

    • Blacklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks